CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- ultimate member forumwpWordPress ForumWP plugin <= 2.1.0 - PHP Object Injection vulnerability9.8 Critical
- suiteplugins video & photo gallery for ultimate memberWordPress Video & Photo Gallery for Ultimate Member plugin <= 1.1.0 - Arbitrary File Upload vulnerability9.9 Critical
- themehunk zita site builderWordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerability9.1 Critical
- sabri sogridWordPress Sogrid plugin <= 1.5.6 - Local File Inclusion vulnerability7.5 High
- quietly insightsWordPress Quietly Insights plugin <= 1.2.2 - Arbitrary Option Update to Privilege Escalation vulnerability8.8 High
- sabri woolookWordPress Woolook plugin <= 1.7.0 - Local File Inclusion vulnerability7.5 High
- filippo bodei wp cookies enablerWordPress WP Cookies Enabler plugin <= 1.0.1 - Local File Inclusion vulnerability7.5 High
- blokhaus minterpressWordPress Minterpress plugin <= 1.0.5 - Arbitrary Option Update to Privilege Escalation vulnerability8.8 High
- prince radio playerWordPress Radio Player plugin <= 2.0.83 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- bold-themes bold page builderWordPress Bold Page Builder plugin <= 5.1.5 - Path Traversal vulnerability4.9 Medium
- jaytesh barange posts date rangesWordPress Posts Date Ranges plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- becky sanders increase sociabilityWordPress Increase Sociability plugin <= 1.3.0 - Reflected Cross Site Request Forgery (CSRF) vulnerability7.1 High
- bouzid nazim zitouni taggatorWordPress TagGator plugin <= 1.54 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- moallemi comments on feedWordPress Comments On Feed plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- oktoberfive visual recent postsWordPress Visual Recent Posts plugin <= 1.2.3 - Reflected Cross Site Request Forgery (CSRF) vulnerability7.1 High
- gaowei tang evernote syncWordPress Evernote Sync plugin <= 3.0.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- rnystrom tsb occasion editorWordPress TSB Occasion Editor plugin <= 1.2.1 - SQL Injection vulnerability8.5 High
- chris carvache etemplatesWordPress eTemplates plugin <= 0.2.1 - SQL Injection vulnerability9.3 Critical
- ams nexe iberica mimoosWordPress Mimoos plugin <= 1.2 - SQL Injection vulnerability8.5 High
- binarycarpenter launchpage.app importerWordPress LaunchPage.app Importer plugin <= 1.1 - SQL Injection vulnerability9.3 Critical
- mike leembruggen critical site intelWordPress Critical Site Intel plugin <= 1.0 - SQL Injection vulnerability9.3 Critical
- walletstation code generator proWordPress Code Generator Pro plugin <= 1.2 - SQL Injection vulnerability9.3 Critical
- robindkumar wr age verificationWordPress Wr Age Verification plugin <= 2.0.0 - SQL Injection vulnerability9.3 Critical
- robindkumar wr age verificationWordPress Wr Age Verification plugin <= 2.0.0 - SQL Injection vulnerability8.5 High
- richteam share buttons – social mediaWordPress Share Buttons – Social Media plugin <= 1.0.2 - SQL Injection vulnerability9.3 Critical
- nabajit roy nabz image galleryWordPress Nabz Image Gallery plugin <= v1.00 - SQL Injection vulnerability9.3 Critical
- telemessage serviceWordPress Service plugin <= 1.0.4 - SQL Injection vulnerability8.5 High
- amol nirmala waman navayan csv exportWordPress Navayan CSV Export Plugin <= 1.0.9 - SQL Injection vulnerability9.3 Critical
- ritesh sanap advanced what should we write next aboutWordPress Advanced What should we write next about plugin <= 1.0.3 - SQL Injection vulnerability8.5 High
- dreamfox media payment gateway per product for woocommerceWordPress Payment gateway per Product for WooCommerce plugin <= 3.5.6 - Broken Access Control vulnerability6.1 Medium
- wovax idx, wovax, llc. wovax idx +1 moreWordPress Wovax IDX plugin <= 1.2.2 - Account Takeover vulnerability8.8 High
- anh tran falcon – wordpress optimizations & tweaksWordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.8.3 - Broken Access Control vulnerability4.3 Medium
- open tools woocommerce basic ordernumbersWordPress WooCommerce Basic Ordernumbers plugin <= 1.4.4 - Broken Access Control vulnerability5.4 Medium
- pixelgrade pixproofWordPress PixProof plugin <= 2.0.1 - Broken Access Control vulnerability5.3 Medium
- pickplugins job board managerWordPress Job Board Manager plugin <= 2.1.61 - Broken Access Control vulnerability5.3 Medium
- ksherWordPress Ksher plugin <= 1.1.1 - Broken Access Control vulnerability6.5 Medium
- sohu 畅言评论系统WordPress 畅言评论系统 plugin <= 2.0.5 - Broken Access Control vulnerability4.3 Medium
- leader codes leaderWordPress Leader plugin <= 2.6.1 - Broken Access Control vulnerability4.3 Medium
- spreadr woocommerceWordPress Spreadr Woocommerce plugin <= 1.0.4 - Broken Access Control vulnerability5.3 Medium
- premila gutenseeWordPress Gutensee plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cortesfrau better wp login pageWordPress Better WP Login Page plugin <= 1.1.2 - Stored Cross Site Scripting (XSS) vulnerability5.9 Medium
- meini utech world timeWordPress Utech World Time Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pluginscafe advanced data table for elementorWordPress Advanced Data Table For Elementor plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ilja zaglov responsive google maps | by imbaaWordPress Responsive Google Maps | by imbaa plugin <= 1.2.5 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- micha i plant a treeWordPress I Plant A Tree plugin <= 1.7.3 - CSRF to Stored Cross-Site Scripting vulnerability7.1 High
- brandtoss wp mailsterWordPress WP Mailster plugin <= 1.8.17.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- sabri sogridWordPress Sogrid plugin <= 1.5.2 - CSRF to Privilege Escalation vulnerability8.8 High
- vcita online booking & scheduling calendar for wordpress by vcita, online booking \& scheduling calendar +1 moreWordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- elmervillanueva bet sport freeWordPress Bet sport Free plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- sourov amin insertifyWordPress Insertify plugin <= 1.1.4 - CSRF to Remote Code Execution vulnerability9.6 Critical
- Show moreLoading…